WP Manifestindependent plugin directory
manifest / admin / modern-file-and-db-manager

Modern File & DB Manager

Modern File And DB Manager plugin for WordPress

by Camyt Group · github.com/rizaardiyanto1412/modern-file-and-db-manager

★ 6stars
1forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/rizaardiyanto1412/modern-file-and-db-manager/archive/refs/heads/main.zip
Readme github.com/rizaardiyanto1412/modern-file-and-db-manager ↗

Modern File Manager

Modern File Manager is an admin-only WordPress plugin that provides a single-page file manager with no full page refresh while navigating folders.

Screenshots

image image image

Features (v1)

  • Interactive folder navigation (SPA in wp-admin)
  • List files and folders
  • Create folder and file
  • Rename, move, copy, delete
  • Upload and download
  • In-app code editor (CodeMirror 6) with syntax highlight, fold gutter, and theme switcher (Light, One Dark, Monokai, Solarized Dark, Tokyo Night, Nord)
  • Optional DB Manager module (Adminer-based) on a separate admin page
  • Breadcrumb navigation, search, sorting, detail panel
  • Keyboard shortcuts:
    • Ctrl/Cmd + R: refresh current folder
    • Delete: delete selected
    • F2: rename selected item

Security Model

  • Admin capability required: manage_options
  • REST route permission callback on every endpoint
  • Nonce validation (wp_rest)
  • Sandbox root restricted to ABSPATH
  • Path traversal blocked
  • Denylist for sensitive paths (/.git, /.env)

REST Endpoints

Base: /wp-json/modern-file-manager/v1

  • GET /list?path=/...
  • POST /mkdir
  • POST /create-file
  • POST /rename
  • POST /move
  • POST /copy
  • POST /delete
  • POST /upload
  • GET /download?path=/...
  • GET /read-file?path=/...
  • POST /save-file
  • DB Manager launch endpoint: admin-post.php?action=mfm_db_manager_launch (tokenized, admin-only)

Success response:

{
  "ok": true,
  "data": {},
  "meta": {}
}

Error response:

{
  "ok": false,
  "code": "invalid_path",
  "message": "Target path is not a directory.",
  "details": {
    "status": 400
  }
}

Testing

1) Backend security and filesystem tests (PHPUnit)

Install:

composer install

Run:

composer test

Covers:

  • Root listing behavior
  • Denylist protection
  • Traversal rejection
  • Create/rename/move/delete flow
  • Root-delete prevention

Notes

  • The plugin currently uses direct filesystem functions with strict policy checks.
  • CodeMirror 6 is bundled locally in assets/js/codemirror-bundle.js (no CDN runtime dependency).
  • For environments requiring alternate filesystem transport (FTP/SSH), extend Filesystem_Service to integrate WP_Filesystem transport selection.

Third-Party Components

  • Adminer (includes/vendor/adminer/adminer.php) — Apache License 2.0 or GPL v2.